A healthcare group must block phishing and adult sites, block sites with a poor reputation score, and explicitly permit the patient portal despite its miscategorization. CCT traffic stays local with Unified Security policy. Which URL-filtering design meets categorization, reputation and list requirements?

Use URL filtering with category actions, reputation-based blocking, and allow/block lists: category actions block phishing and adult categories, reputation blocking catches URLs with poor scores, and an explicit allow-list entry permits the miscategorized patient portal while deny entries block known threats. This meets all three requirements while keeping CCT traffic local under the stated Unified Security policy. The design that blocks phishing and adult categories and allow-lists the portal but disables reputation scoring misses poor-reputation sites not caught by those category actions. The design that enables reputation blocking and lists but leaves category actions unset cannot enforce the requested phishing and adult category blocks; a portal exception does not replace category policy. The design that includes all three URL-filtering controls but applies them under a Cloud Security policy and sends traffic to Cato Cloud conflicts with the requirement to keep CCT traffic local under Unified Security. Exam caveat: category actions, reputation thresholds, and list precedence are distinct controls, so verify how explicit list entries interact with category decisions in the configured product. Practical check: test representative phishing, adult, poor-reputation, and portal URLs, then inspect URL-filtering logs for category actions, reputation verdicts, list matches, and local CCT handling.